Module apps 

MCP Apps (io.modelcontextprotocol/ui): tools that render an interactive HTML interface in the host.

A server pairs a tool with a UI resource:

• the resource has a ui:// URI and the text/html;profile=mcp-app MIME type, and returns an HTML5 document. Mark it with ResourceDef::app (or #[resource(.., app)]), which also describes what the sandboxed page may load (AppUi);
• the tool names the resource with ToolDef::ui (or #[tool(ui = "ui://..")]), and may restrict who can call it with ToolDef::visibility.

The server declares the extension in server/discover automatically. App-only tools (visibility = ["app"]) are left out of tools/list for clients that do not declare MCP Apps, which would otherwise offer them to the model; visibility is not access control (use OAuth scopes).

The page runs in the host’s sandbox but can call tools through it: do not paste untrusted data into its HTML (cross-site scripting would let an attacker call tools as the user). Send data in tool results instead. Tools with a UI must still return meaningful content: hosts without MCP Apps support show that text, and the model reads it. Check Ctx::client_supports_apps to adapt a result.

Structs

AppUi

How the host should sandbox a UI resource (_meta.ui).

Enums

Permission

A browser capability a UI asks the host for. Hosts may refuse.

Visibility

Who may call a tool.

Constants

EXTENSION_ID

The extension identifier.

MIME_TYPE

The MIME type of UI resources.